Which versions of Apache Traffic Server are affected by CVE-2026-58178?

Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 contain a denial-of-service vulnerability in the ESI plugin that allows unauthenticated remote attackers to exhaust server…

How to fix or mitigate CVE-2026-58178?

Within 24 hours, identify all systems running Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3 with the ESI plugin enabled and assess criticality; if ESI is not business-essential, disable it immediately. Within 7 days, implement network-level controls including rate limiting on upstream requests to ESI plugin endpoints, input validation for URL parameters, and request filtering to block suspicious recursion patterns. Within 30 days, evaluate upgrade paths to versions beyond 10.1.3 if available and test thoroughly in staging, or plan migration to alternative edge-side caching solutions and formally document risk acceptance if patching is not feasible.

Apache Traffic Server CVE-2026-58178

Q: What is the CVSS score of CVE-2026-58178?

CVE-2026-58178 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50223 HIGH

Uncontrolled Recursion (CWE-674)

2026-07-29 apache

GHSA-jmf6-wg5m-793g

Apache Information Disclosure Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N) but requires the optional ESI plugin enabled and attacker-influenced markup, so AC:H; impact is availability-only (A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:57 vuln.today

CVE Published

Jul 29, 2026 - 08:43 cve.org

MEDIUM 7.5

DescriptionCVE.org

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers to trigger unbounded recursion while the plugin fetches attacker-controlled URLs, exhausting server resources. It affects Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 when the ESI plugin is enabled. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance caching and reverse proxy widely used in CDN and edge-serving infrastructure. The Edge Side Includes (ESI) plugin processes ESI markup in responses to assemble pages from multiple fragments, issuing sub-requests to fetch included resources. The root cause is CWE-674 (Uncontrolled Recursion): the plugin follows ESI include directives without enforcing a recursion depth or fan-out limit, so nested or self-referential includes cause it to recurse without bound and repeatedly fetch URLs the attacker can influence. This both amplifies request volume and can drive the proxy to fetch arbitrary attacker-designated endpoints, producing the resource exhaustion characteristic of a recursive/amplification denial of service.

RemediationAI

Vendor-released patch: upgrade Apache Traffic Server to 9.2.15 or 10.1.4, which fix the unbounded recursion in the ESI plugin, as documented in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. The 8.x branch (through 8.1.9) is affected and has no listed fixed release in that branch, so 8.x users should migrate to a patched 9.2.x or 10.1.x line. If immediate patching is not possible, a targeted compensating control is to disable or unload the ESI plugin (remove it from plugin.config / remap.config) where ESI processing is not required, which eliminates the vulnerable code path at the cost of losing edge-side include assembly; alternatively, restrict which upstream/origin URLs the plugin is permitted to fetch and enforce request-rate and connection limits at the proxy to blunt the amplification, accepting that these throttle but do not fully close the recursion issue.